CVE-2026-24156
Published: 07 April 2026
Summary
CVE-2026-24156 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Custhelp (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 19.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-24156 is a vulnerability in NVIDIA DALI that enables deserialization of untrusted data, which could allow an attacker to achieve arbitrary code execution. The affected component is NVIDIA DALI, with the issue tracked under CWE-502 (Deserialization of Untrusted Data). The vulnerability received a CVSS v3.1 base score of 7.3 (High) and was published on 2026-04-07T18:16:39.647.
Exploitation requires local access (AV:L), low attack complexity (AC:L), low privileges (PR:L), and user interaction (UI:R), with no change in scope (S:U). A successful attack can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), potentially leading to arbitrary code execution on the affected system.
Mitigation details are available in official advisories, including NVIDIA's security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5811, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-24156, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-24156.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19753
Vulnerability details
NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to arbitrary code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization of untrusted data (CWE-502) directly enables client-side arbitrary code execution (T1203) with user interaction; resulting RCE facilitates command/script execution (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of identified flaws like CVE-2026-24156 through patching to prevent deserialization-based arbitrary code execution.
Requires validation of untrusted inputs to NVIDIA DALI to block malicious serialized data that could be deserialized leading to code execution.
Implements memory protections such as ASLR and DEP to hinder reliable arbitrary code execution even if deserialization of untrusted data succeeds.